microsoft/aspire · error · ArgumentException

An association named

Error message

An association named '{associationName}' already exists in Network Security Perimeter '{nsp.Resource.Name}'.

What it means

WithNetworkSecurityPerimeter associates a target resource with an NSP and takes an association name (defaulting to '<target>-assoc'). Association names must be unique within the perimeter, so adding an association whose name already exists throws ArgumentException (case-insensitive comparison).

Solutions

Pass an explicit, unique associationName for each WithNetworkSecurityPerimeter call.
Ensure the same target is not associated with the perimeter twice.
If resource names could collide, build association names that include a discriminator (subscription/scope or index).
Check nsp.Resource.Associations before adding when names are computed dynamically.

Example fix

// before
nsp.WithNetworkSecurityPerimeter(target, "my-assoc");
nsp.WithNetworkSecurityPerimeter(other, "my-assoc");
// after
nsp.WithNetworkSecurityPerimeter(target, $"{target.Resource.Name}-assoc");
nsp.WithNetworkSecurityPerimeter(other, $"{other.Resource.Name}-assoc");

Defensive patterns

Strategy: validation

Validate before calling

var name = associationName ?? $"{target.Resource.Name}-assoc";
if (nsp.Resource.Associations.Any(a => string.Equals(a.Name, name, StringComparison.OrdinalIgnoreCase)))
    throw new ArgumentException($"Association '{name}' already exists in NSP '{nsp.Resource.Name}'.");

Try / catch

try { nsp.WithNetworkSecurityPerimeter(target); }
catch (ArgumentException ex) when (ex.Message.Contains("already exists")) { /* association already configured; skip or pass a unique name */ }

Prevention

Pass explicit unique associationName values when associating multiple targets.
Avoid associating the same target with a perimeter twice.
Guard against target resource-name collisions when relying on the default '<target>-assoc' name.
Check nsp.Resource.Associations before programmatic association additions.

When it happens

Trigger: Calling WithNetworkSecurityPerimeter for a second target whose generated or explicit associationName matches an existing association in the same NSP — e.g. two resources with the same name, or the same target associated twice.

Common situations: Reusing a constant associationName across multiple WithNetworkSecurityPerimeter calls, associating the same resource to a perimeter twice, or two resources whose names collide producing the same default '<target>-assoc' name.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/e4ccd410f4f216b5. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Network/AzureNetworkSecurityPerimeterExtensions.cs:148

    /// storage.WithNetworkSecurityPerimeter(nsp);
    /// keyVault.WithNetworkSecurityPerimeter(nsp, NetworkSecurityPerimeterAssociationAccessMode.Learning);
    /// </code>
    /// </example>
    [AspireExport("associateWithNetworkSecurityPerimeter", MethodName = "withNetworkSecurityPerimeter")]
    public static IResourceBuilder<T> WithNetworkSecurityPerimeter<T>(
        this IResourceBuilder<T> target,
        IResourceBuilder<AzureNetworkSecurityPerimeterResource> nsp,
        NetworkSecurityPerimeterAssociationAccessMode accessMode = NetworkSecurityPerimeterAssociationAccessMode.Enforced,
        string? associationName = null) where T : IResource, IAzureNspAssociationTarget
    {
        ArgumentNullException.ThrowIfNull(target);
        ArgumentNullException.ThrowIfNull(nsp);

        associationName ??= $"{target.Resource.Name}-assoc";

        if (nsp.Resource.Associations.Any(a => string.Equals(a.Name, associationName, StringComparison.OrdinalIgnoreCase)))
        {
            throw new ArgumentException(
                $"An association named '{associationName}' already exists in Network Security Perimeter '{nsp.Resource.Name}'.",
                nameof(associationName));
        }

        nsp.Resource.Associations.Add(new AzureNetworkSecurityPerimeterResource.NspAssociationConfig(
            associationName,
            target.Resource.Id,
            accessMode));

        return target;
    }

    private static void ConfigureNetworkSecurityPerimeter(AzureResourceInfrastructure infra)
    {
        var azureResource = (AzureNetworkSecurityPerimeterResource)infra.AspireResource;

        var nsp = AzureProvisioningResource.CreateExistingOrNewProvisionableResource(infra,
            (identifier, name) =>

View on GitHub (pinned to 25830f84bd)